66e26a3260b49cec2892d09e839a6f8349eb667de5580a62f433c55f93661812

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe
Size

1.0MB
MD5

0873415c13efe3098d38e128edbb2380
SHA1

f71b7ee73104510957a11f33d3b26a343f1d3671
SHA256

66e26a3260b49cec2892d09e839a6f8349eb667de5580a62f433c55f93661812
SHA512

3aa62d80cdacab68ce972c28d092b16e88868c666cf411941cc7124dfc0eca259bad83ce82d01ed6425cedf6a75afe3cfd7494ab48e43fce6b771ef9b09f84c6
SSDEEP

6144:nLJ2B4cK3zh5Bopbk7tlIntCN9Giu/qqdM4zjvzf1DvF6TZd8HjL8RJW7GG2JI:LJihK3zOxgtq+mq74zj2wX8WGG2q

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
884	WinSys32.exe
4544	WinSys32.exe
2724	WinSys32.exe
4180	WinSys32.exe
3724	WinSys32.exe
3940	WinSys32.exe
2860	WinSys32.exe
384	WinSys32.exe
3256	WinSys32.exe
2484	WinSys32.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinSys32.exe	0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File created	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe
File opened for modification	C:\Windows\SysWOW64\WinSys32.exe	WinSys32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 884	2836	0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe	84
PID 2836 wrote to memory of 884	2836	0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe	84
PID 2836 wrote to memory of 884	2836	0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe	84
PID 884 wrote to memory of 4544	884	WinSys32.exe	95
PID 884 wrote to memory of 4544	884	WinSys32.exe	95
PID 884 wrote to memory of 4544	884	WinSys32.exe	95
PID 4544 wrote to memory of 2724	4544	WinSys32.exe	97
PID 4544 wrote to memory of 2724	4544	WinSys32.exe	97
PID 4544 wrote to memory of 2724	4544	WinSys32.exe	97
PID 2724 wrote to memory of 4180	2724	WinSys32.exe	100
PID 2724 wrote to memory of 4180	2724	WinSys32.exe	100
PID 2724 wrote to memory of 4180	2724	WinSys32.exe	100
PID 4180 wrote to memory of 3724	4180	WinSys32.exe	101
PID 4180 wrote to memory of 3724	4180	WinSys32.exe	101
PID 4180 wrote to memory of 3724	4180	WinSys32.exe	101
PID 3724 wrote to memory of 3940	3724	WinSys32.exe	104
PID 3724 wrote to memory of 3940	3724	WinSys32.exe	104
PID 3724 wrote to memory of 3940	3724	WinSys32.exe	104
PID 3940 wrote to memory of 2860	3940	WinSys32.exe	105
PID 3940 wrote to memory of 2860	3940	WinSys32.exe	105
PID 3940 wrote to memory of 2860	3940	WinSys32.exe	105
PID 2860 wrote to memory of 384	2860	WinSys32.exe	108
PID 2860 wrote to memory of 384	2860	WinSys32.exe	108
PID 2860 wrote to memory of 384	2860	WinSys32.exe	108
PID 384 wrote to memory of 3256	384	WinSys32.exe	109
PID 384 wrote to memory of 3256	384	WinSys32.exe	109
PID 384 wrote to memory of 3256	384	WinSys32.exe	109
PID 3256 wrote to memory of 2484	3256	WinSys32.exe	110
PID 3256 wrote to memory of 2484	3256	WinSys32.exe	110
PID 3256 wrote to memory of 2484	3256	WinSys32.exe	110

C:\Users\Admin\AppData\Local\Temp\0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\WinSys32.exe
  C:\Windows\system32\WinSys32.exe 1148 "C:\Users\Admin\AppData\Local\Temp\0873415c13efe3098d38e128edbb2380_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\WinSys32.exe
    C:\Windows\system32\WinSys32.exe 1152 "C:\Windows\SysWOW64\WinSys32.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\WinSys32.exe
      C:\Windows\system32\WinSys32.exe 1120 "C:\Windows\SysWOW64\WinSys32.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1124 "C:\Windows\SysWOW64\WinSys32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4180
      - C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1128 "C:\Windows\SysWOW64\WinSys32.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1132 "C:\Windows\SysWOW64\WinSys32.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1144 "C:\Windows\SysWOW64\WinSys32.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1140 "C:\Windows\SysWOW64\WinSys32.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1160 "C:\Windows\SysWOW64\WinSys32.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\WinSys32.exe
        
        C:\Windows\system32\WinSys32.exe 1136 "C:\Windows\SysWOW64\WinSys32.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinSys32.exe

Filesize
1.0MB

MD5
0873415c13efe3098d38e128edbb2380

SHA1
f71b7ee73104510957a11f33d3b26a343f1d3671

SHA256
66e26a3260b49cec2892d09e839a6f8349eb667de5580a62f433c55f93661812

SHA512
3aa62d80cdacab68ce972c28d092b16e88868c666cf411941cc7124dfc0eca259bad83ce82d01ed6425cedf6a75afe3cfd7494ab48e43fce6b771ef9b09f84c6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads